All vulnerabilities
CVE-2026-57286GHSA-hwvp-7xqv-8jx3

org.jenkins-ci.tools:git-parameter: Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names

Jenkins Project org.jenkins-ci.tools:git-parametermavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in462.463Fixed versionGitHub
Published24 Jun 2026Updated 25 Sep 2026CVE List

What fixes it

  • 462.463org.jenkins-ci.tools:git-parameter, mavenGitHub<dependency><groupId>org.jenkins-ci.tools</groupId><artifactId>git-parameter</artifactId><version>462.463</version></dependency>
  • 462.463org.jenkins-ci.tools:git-parameter, MavenOSV<dependency><groupId>org.jenkins-ci.tools</groupId><artifactId>git-parameter</artifactId><version>462.463</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier does not perform a permission check in an HTTP endpoint that populates the list of values for Git parameters by querying the SCM configured on a job, using the SCM credentials configured in Jenkins.

This allows attackers with Item/Read permission to obtain information about the SCM repository used by a job they would otherwise be unable to access, such as branch names, tag names, and revision metadata.

Git Parameter Plugin 462.463.v496a_59f698e5 requires Item/Build permission to populate the list of values for Git parameters.

Text from GitHub Advisory Database

Affected versions 41

  • org.jenkins-ci.tools:git-parameter, maven< 462.463GitHub
  • Jenkins Git Parameter Pluginaffected: all versions through 462.vdcf3df2ed2ca_CVE List
  • org.jenkins-ci.tools:git-parameter, Mavenfrom first release, fixed in 462.463OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.10.0OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.11.0OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.4.0OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.5.0OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.5.1OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.6.0OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.6.1OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.6.2OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.7.0OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.7.1OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.7.2OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.8.0OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.8.1OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.0OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.1OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.10OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.11OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.12OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.13OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.14OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.15OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.16OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.17OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.18OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.19OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.2OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.3OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.4OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.5OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.6OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.7OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.8OSV
  • org.jenkins-ci.tools:git-parameter, Maven0.9.9OSV
  • org.jenkins-ci.tools:git-parameter, Maven435.va_f85861c663a_OSV
  • org.jenkins-ci.tools:git-parameter, Maven439.vb_0e46ca_14534OSV
  • org.jenkins-ci.tools:git-parameter, Maven444.vca_b_84d3703c2OSV
  • org.jenkins-ci.tools:git-parameter, Maven460.v71e7583a_c099OSV
  • org.jenkins-ci.tools:git-parameter, Maven462.vdcf3df2ed2ca_OSV

References 5